Privacy Policy

1. Who we are

DeFolio is offered by Lasse Christensen. We are responsible (the controller) for the processing of personal data described in this policy.

For privacy questions and requests, and anything else, email defolioapp@gmail.com.

We have not appointed a data protection officer, as the law does not require us to.

2. In short

• DeFolio reads your DeGiro exports in your browser and stores what they contain encrypted on your own device. Your portfolio data is never sent to us, and we have no copy of it.
• For your account, payments and hosting we use Google Firebase, Stripe and Cloudflare.
• To look up regions and the benchmark, our server receives the ISINs in your portfolio and the period your data covers, and passes them on. It does not analyse them or store them with your account; lookup results stay in its memory for at most 24 hours, to answer the same lookup faster.
• We use no analytics, advertising or tracking cookies, and we do not sell your data.

The sections below give the details.

3. Your portfolio data stays on your device

DeFolio reads the CSV files you export from DeGiro, such as your account statement and portfolio exports, in your browser. What they contain, such as your transactions, positions, cash balances, dividends and costs, is processed in your browser and stored on the device you use. It is not sent to our server or to anyone else. The same goes for what you add yourself, such as strategy labels.

DeFolio stores this data in your browser's database (IndexedDB), encrypted with AES-GCM and a 256-bit key, separately for each account that signs in on that browser. Backup files you make are encrypted with the same key.

When you sign in while your subscription is active, our server derives your key from a secret that only our server holds and from your account ID, and sends it to your browser over an encrypted connection. The server does not store the key: it calculates it again each time. This means:

• Because the key is derived from our server secret, we could technically calculate it. That does not give us your data, because we never receive your data or encrypted copies of it. Someone who had your encrypted data, our server secret and your account ID could decrypt it, which is why we keep the server secret protected.
• While you are signed in, your data is decrypted in your browser so DeFolio can show it. Anyone who can use your device or browser at that moment can see it.
• Your browser only gets the key while your subscription is active. If your subscription ends, your data stays encrypted on your device, but DeFolio cannot open it until you subscribe again with the same account.
• Your data is not synchronised between browsers or devices. You can move it with a backup file, which only the same account can restore.

Some things DeFolio keeps in your browser are not encrypted:

• Your settings, such as your language and privacy mode (see section 9).
• Files you download yourself. A CSV file of your transactions is not encrypted; a backup file is.

Because we do not have this data, we cannot view, correct, recover or delete it for you. You manage it yourself, in DeFolio or through your browser settings (see section 8).

4. What we process, why and on which basis

Below you can read, per purpose, which personal data we process, why, on which legal basis under the General Data Protection Regulation (GDPR), and who helps us. Section 7 lists how long we keep it.

4.1 Visiting our website

When you visit defolio.app, your browser sends technical data to our hosting provider Cloudflare, as with any website: your IP address, the page you request, the date and time, and details of your browser and device. This is needed to deliver the website and our server functions and to protect them against misuse and attacks.

Basis: our legitimate interest in offering a working and secure website (art. 6(1)(f) GDPR).

4.2 The waitlist

While sign-up is closed, you can join the waitlist. We then receive: your email address; that you ticked the consent box; the language of the page; and the date and time. We store nothing else with it, so no IP address or browser details.

We use your email address to send you one email when you can sign up for DeFolio, in your language. We use this data for nothing else and do not add you to a newsletter.

Basis: your consent (art. 6(1)(a) GDPR), which you give by ticking the box. It covers the launch email. You can withdraw your consent at any time by emailing defolioapp@gmail.com; we then delete your submission. This does not affect what we did before you withdrew it.

To keep spam out, the form has a hidden field that only bots fill in, and Cloudflare counts the submissions from each IP address for one minute, so a single address can only send a few. That count is not stored with your submission. Basis: our legitimate interest in keeping spam out (art. 6(1)(f) GDPR).

We delete your submission within one month after sending the launch email, and in any case no later than 12 months after you sent it.

4.3 Your account

To create and secure your account, we process: your email address; your password, which Firebase stores only in hashed form, so we never see it; your account ID; how you sign in (with email and password, or with Google); when your account was created and when you last signed in; and, for security, the IP address and browser you sign in with. If you sign in with Google, Google also passes on the name and the profile picture link of your Google account.

We use this to create your account, sign you in, keep you signed in if you choose Remember me, send you emails to reset your password or confirm a new email address, and protect accounts against misuse.

Basis: performing the contract with you (art. 6(1)(b) GDPR). For protection against misuse: our legitimate interest in secure accounts (art. 6(1)(f) GDPR).

Google provides this through Firebase Authentication, as our processor. If you choose Continue with Google, Google also handles the sign-in to your Google account as a controller, under Google's own privacy policy.

While sign-up is closed, Firebase automatically creates an account when someone signs in with a Google account it does not know yet. DeFolio deletes such an account straight away.

4.4 Your subscription and payments

Payments are handled by Stripe. When you subscribe, we pass your email address and your account ID to Stripe. On Stripe's checkout page you enter your payment details. Stripe then processes, among other things, your name, email address, payment details, billing country or address where needed, your payments and invoices, and technical data such as your IP address to prevent fraud. We never see your full card or bank account number; in Stripe we see, for example, the type of payment method and its last digits.

Stripe informs our server of changes to your subscription. We then store with your account in Firebase: your Stripe customer ID, the status of your subscription, the end date of the current billing period, the date your subscription ends if you have cancelled it, and the time of the last change. DeFolio uses this to know whether your subscription is active.

We use this data to collect payments, manage your subscription, give you access and keep our accounts.

Basis: performing the contract (art. 6(1)(b) GDPR) and a legal obligation (art. 6(1)(c) GDPR): Dutch tax law requires us to keep our records, including invoices, for seven years (art. 52 of the General State Taxes Act, AWR).

Stripe processes this data partly on our behalf, as our processor, and partly as an independent controller, for example to prevent fraud and to meet its own legal obligations as a payment service provider. For that part, Stripe's privacy policy applies.

4.5 Regions and the benchmark

Some parts of the dashboard need market data. Your browser then sends our server the ISINs of your positions (to look up their region and type) and the period your data covers (for the comparison with the MSCI World). These requests carry your sign-in token, because only subscribers may make them. Our server uses the ISINs and dates only for the lookup and does not store them with your account. To limit the number of lookups, it keeps the results in its memory for up to 24 hours, without any link to you.

Our server passes on only ISINs, to OpenFIGI (a service of Bloomberg), and a period, to Yahoo Finance and Frankfurter. They receive no account details, no IP address of yours and no amounts from us.

Basis: performing the contract (art. 6(1)(b) GDPR).

4.6 Your encryption key

To give your browser its key (section 3), our server checks your sign-in token and whether your subscription is active, and derives the key from your account ID. None of this is stored. Basis: performing the contract (art. 6(1)(b) GDPR).

4.7 Email

When you email us, we process your email address, your message and anything you send with it, to answer you and to handle questions, complaints, withdrawals and privacy requests. Basis: performing the contract where your message is about it (art. 6(1)(b) GDPR), a legal obligation for privacy requests (art. 6(1)(c) GDPR), and otherwise our legitimate interest in answering messages (art. 6(1)(f) GDPR).

We may also email you about your subscription, for example about a change to the price, our terms or this policy. Stripe may send you receipts and payment messages on our behalf. Basis: performing the contract and legal obligations (art. 6(1)(b) and (c) GDPR). These are not marketing messages.

4.8 Legal obligations and disputes

We may use the data above where needed to comply with a legal obligation, such as a lawful order from an authority (art. 6(1)(c) GDPR), or to establish, exercise or defend legal claims, based on our legitimate interest in doing so (art. 6(1)(f) GDPR).

5. Who receives your data

We only share personal data where this is needed for the purposes in section 4:

• Cloudflare, Inc. (United States): hosts our website and server functions and stores the waitlist. Processor.
• Google (Firebase Authentication): accounts, signing in and emails to reset your password or change your email address. Processor. When you sign in with Google, Google is also a controller for your Google account.
• Stripe (Stripe Payments Europe, Limited, Ireland, and its affiliates): payments, subscriptions and invoices. Processor, and an independent controller for its own purposes (section 4.4).
• Our email provider: processes the emails we send and receive. Processor.
• OpenFIGI (Bloomberg), Yahoo Finance and Frankfurter: receive ISINs or a period from our server, but nothing that identifies you.
• Authorities: only where the law requires us to, for example the Dutch Tax and Customs Administration.

We have agreed terms on the processing of personal data with our processors. We do not sell or rent out your personal data and do not share it for advertising.

6. Data outside the European Economic Area

Cloudflare, Google and Stripe are, or belong to, companies based in the United States, and your data may be processed there. Such transfers take place on the basis of the European Commission's adequacy decision for the EU-US Data Privacy Framework, for companies certified under it, and otherwise on the basis of the standard contractual clauses approved by the European Commission. You can ask us for more information about these safeguards.

7. How long we keep data

• Portfolio data on your device: until you delete it (section 8). We do not hold it.
• Your account: as long as you have it. After deletion, Google removes the data from its live and backup systems within 180 days, according to Google. Google keeps the IP addresses it logs at sign-in for a few weeks.
• Subscription details with your account: as long as you have your account.
• Payment records and invoices: seven years, as Dutch tax law requires. Stripe may keep data longer for its own legal obligations.
• Waitlist: until one month after the launch email and no longer than 12 months after you sent the form, or until you withdraw your consent (section 4.2).
• Email with us: up to two years after the conversation has ended, or longer if needed for a dispute or required by law.
• Technical data at Cloudflare: only as long as Cloudflare needs it to deliver and secure the service, according to its own retention periods.
• Lookups through our server: not stored. Results stay in memory for up to 24 hours, without any link to you.

8. Deleting your data and your account

Clear local data on the Account page removes everything DeFolio stored for your account in the browser you use, such as your imports and strategy labels. Your account and subscription stay.

You can delete your account on the Account page once you have cancelled your subscription in the subscription portal. Your account is then deleted straight away, together with everything DeFolio stored for your account in the browser you do it in. Your subscription is not renewed and ends at the end of the period you have paid for, without a refund for the rest of that period.

Once your subscription has ended, you can no longer open the Account page. Email defolioapp@gmail.com and we delete your account for you. You can also email us at any other time to have your account deleted: we then cancel your subscription and delete your account.

Deleting your account removes data only from the browser you do it in. Your language and privacy mode settings stay there until you clear the site data. On other devices and browsers where you used DeFolio, clear the site data for defolio.app yourself: we cannot reach them. Backup files you made stay with you, but can no longer be restored once your account is deleted.

Payment records and invoices stay with Stripe for seven years, because tax law requires us to keep them. You can ask us to have other data at Stripe deleted.

9. Cookies and similar storage

DeFolio stores some information in your browser and reads it back. Under the Dutch Telecommunications Act (art. 11.7a Telecommunicatiewet), this requires your consent unless it is strictly necessary for the service you ask for. Everything below is needed for DeFolio to work, or remembers a choice you made yourself. That is why we do not ask for consent and do not show a cookie banner. We use no analytics, advertising or tracking cookies, and our fonts are served from our own domain.

Cookies

• session_hint: set when you sign in with Remember me while your subscription is active, so that opening defolio.app takes you straight to your dashboard. It only contains the value 1. It expires 30 days after it was last set and is removed when you sign out or your subscription is no longer active.
• hint_redirect: set for the one redirect from the home page to your dashboard, so DeFolio knows where you came from if your session turns out to have ended. It expires after 60 seconds and is removed as soon as it has been read.

Local storage

• lang: your language, English or Dutch. Kept until you change it or clear your browser data.
• privacyMode, privacyScrambleFactor: your privacy mode (show, blur or scramble amounts) and, for scramble, the random factor it uses. Kept until you change it or clear your browser data.

Session storage

• authSessionOnly: remembers that you signed in without Remember me, so that no session_hint cookie is set. Removed when you close the tab.

IndexedDB

• degiro-portfolio: your encrypted portfolio data (section 3), per account. Kept until you delete it in DeFolio or clear your browser data.

Signing in

Firebase Authentication keeps your sign-in session in your browser: in local storage or IndexedDB if you choose Remember me, until you sign out; otherwise in session storage, until you close the tab.

Other websites

Stripe's checkout page and subscription portal and Google's sign-in window are pages of Stripe and Google on their own domains. The parts Firebase loads for signing in with Google also come from Google's domains. They may use their own cookies there, under their own policies.

You can delete all of this in your browser settings. Note that clearing the site data for defolio.app also deletes your imported portfolio data in that browser and signs you out.

10. Security

• All connections use HTTPS, and our website tells browsers to use only HTTPS.
• Your portfolio data is encrypted on your device (section 3) and is never sent to us.
• Our server functions only answer requests with a valid sign-in token, or for payment updates a valid signature from Stripe, and only hand out your key and market data while your subscription is active.
• We never see your password or your full payment details: Firebase and Stripe handle them.
• We protect our server secret and our accounts with our providers, and limit access to them.
• If a data breach occurs, we report it to the Autoriteit Persoonsgegevens and inform you where the law requires it.

No system is completely secure. Help protect your data too: use a strong, unique password, keep your device locked and up to date, and sign out on shared devices.

11. Your rights

Under the GDPR you have the right to:

• access the personal data we process about you;
• have incorrect data corrected;
• have your data deleted;
• have the processing restricted;
• receive the data you gave us in a common, machine-readable format, or have it passed on to someone else;
• object to processing based on our legitimate interest, for reasons relating to your situation;
• withdraw your consent at any time, without affecting earlier processing.

To use these rights, email defolioapp@gmail.com. We respond within one month. If a request is complex, or there are many, we may extend this by two months; we then tell you why within the first month. It is free. We may ask you to confirm who you are, for example by emailing us from the address of your account.

For the data on your device you do not need us: in DeFolio you can view it, save it as a backup, download your transactions as a CSV file, and delete it. We cannot do this for you, because we do not have it.

You can also complain to the Autoriteit Persoonsgegevens, the Dutch data protection authority, or to the authority in the EU country where you live or work. We would appreciate hearing from you first, so we can try to resolve it together.

12. Required data and automated decisions

To use DeFolio you need to give an email address, a password if you do not sign in with Google, and payment details. Without them we cannot conclude or perform the contract. For the waitlist, we need your email address to send you the launch email. No law requires you to give us personal data.

We do not take decisions about you based solely on automated processing, including profiling, within the meaning of art. 22 GDPR. Stripe may screen payments for fraud automatically, under its own responsibility.

13. Children

DeFolio is not intended for children. You must be 16 or older to join the waitlist, and 18 or older to create an account and subscribe (see our terms and conditions). If we find out that we have received data from someone under 16 without consent from a parent or guardian, we delete it.

14. Changes to this policy

We may change this policy, for example when DeFolio or the law changes. The date at the top shows when it last changed. If a change affects you significantly, we tell you by email before it takes effect, if we have your email address. If a change requires your consent, we ask for it first.

15. Contact

DeFolio is offered by Lasse Christensen.

• Privacy: defolioapp@gmail.com
• Other questions: defolioapp@gmail.com